User Auth
The main-era native /v1/user/auth/* password surface, kept request/response compatible. Credentials verify against the bundled Cognito pool server-side; every token returned is an ESP User token.
Password sign-in
Signs in with `username` and `password`, verified against the bundled Cognito pool, and returns an ESP User token set.
Refresh tokens
Exchanges a refresh token for a new token set. The refresh token rotates: store the new one, because replaying a spent one ends the login.
Create an account
Creates an account with exactly one of `email` or `phone_number` plus a `password`, and sends a verification code to confirm at `signup/verify`.
Confirm signup
Confirm signup
Start password recovery
Start password recovery
Confirm password recovery
Confirm password recovery
Change password
Changes the caller's password. Requires this issuer's access token and the current password. Other sessions stay signed in.
Sign out
Ends the login the refresh token belongs to (its refresh family), the same as `/oauth2/revoke`. `global: 'true'` is refused with `400`; sign out each login with its own refresh token.